The software shown here is already running. Try the demo. Your own copy of Approval, deleted after 24 hours. No sign-up.
What this is about
Before a team works with AI, two questions need an answer: which data may a model receive, and who checks what it produces? Our libraries enforce the data rules and record every review decision. Here is how, by example.
An example
Ms Berger and Kai
Ms Berger keeps the customer records in accounts. Kai is her team’s AI assistant: he reads incoming requests and drafts the changes. Whether they are made is Ms Berger’s call.
Data disclosure and missing decision records
Data sent outside your organisation
Confidential content is sent to an outside AI service without anyone checking it first.
Decisions without proof
Without a decision record, it is hard to reconstruct later who approved a change and why.
Every request, the same path
The path of an AI request
Each station passes on only what it has checked. That is how a request becomes a decision you can prove.
ExampleA customer changes their bank detailsInvented case, for illustration.
01
Request
A department sends in a case, with its documents.
The email: “Please change my bank details. New IBAN attached.”
02
Classification
Public, internal or confidential — checked before every model call. Confidential content stays in your environment.
Name and IBAN are confidential, so Kai uses a model in your environment. These details stay there.
Software approval, with the AI doing the groundwork
Every new piece of software needs approval from data protection and information security. That means reading the documents, collecting the facts, writing the assessments. In Approval the AI does this groundwork — only your officers may sign.
The question on the table
“May we use this new software tool?”
A department requests software. Approval reads five vendor documents, drafts both assessments and puts them in front of your officers.
1
Facts extracted for your review
Five documents, fourteen facts, each with its quote. A quote the document does not contain is rejected.
2
Your team decides
The model proposes and drafts. A person accepts each fact, and only the officers can sign.
3
The evidence is recorded
The log records every request, document version, decision and signature. Hash-linked entries make later changes detectable.
4
It notices when the facts change
A changed document invalidates the facts it no longer supports and reopens the approval based on them.
Watch it run
Approval first checks whether the software is already approved for the same use; if it is, that approval and its conditions apply and no new review starts. Otherwise it stores the vendor documents, and a new vendor’s sources and identity are checked first. A model extracts facts with supporting quotes; a quote that is not in the documents is rejected, and a person accepts, corrects or rejects each fact before the model drafts two assessments. The data protection and security officers each review and sign their part; one refusal rejects the request. The request, every document version, every decision and every signature are recorded in a tamper-evident log. When a vendor document changes, the affected fact is invalidated, the approval is out of date and a re-assessment supersedes it; an approval nearing its end is renewed from the current facts.
ExampleApproval · Request S-112Approval · Request S-117RunningWaiting for a personWaiting for 2 signaturesApprovedRe-check neededRe-assessment S-131Rejected
↩ Document changed → S-131 supersedes S-112↩ Expires in 60 days → renewal
1AIFactsReading and quoting…2 quotes not in the documents14 facts quoted · 1 quote rejected13 facts quoted · 2 quotes rejected1 fact invalidatedS-131: quoting the new version…
2PersonFact reviewAccepts or rejects each factThe quote is real, the reading is wrong14 facts verifiedAll data stays in the EUHosted in the EU, support access from the US
AIDraftsDrafting from verified facts…Security and data-protection drafts
PersonData protection officerReviews and signs2 fields edited · signedSigned “no”, with reasonNotified#1039#1069
PersonSecurity officerNot needed after a “no”Reviews and signsSigned with 1 conditionNotified#1041
Both signed?
4SystemApprovedBoth officers signed. Models cannot sign.Out of date · both officers notified
SystemRejectedOne “no”, with its reasonUS support access · reason on record
S-131
Processing agreement · v1
§ 4.1 “Customer data is hosted in data centres in Frankfurt am Main.” § 4.3 Support staff access the service as listed in annex 2. § 7.2 “Personal data is deleted within 30 days of the end of the contract.”
“Backups are encrypted with keys the customer holds.”not in the document · rejected
“No data leaves the EU.”not in the document · rejected
“Support is provided from within the EU.”not in the document · rejected
3Ledger · hash-chained
#1069Data-protection part signed: no, with reasonprev 0f6a…c3b9→91ce…7d20
Freiday shares your availability by link: a week view of busy and free times from all your calendars. The link expires on its own. Freiday stores no titles, places or attendees, only when you are busy.
Reynt helps holiday rental operators manage bookings, offers, payments and invoices, with storefronts and compliance features. We develop and operate it using our published libraries.